CVE-2026-61902

Not scored yetLast modified Oct 22, 2026

Description

Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing.

A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured limit, which may lead to memory exhaustion and denial of service. Users should upgrade to 1.18.0 or apply the patch from PR https://github.com/apache/brpc/pull/3382 . The fix rejects oversized buffered HTTP bodies, returns HTTP 413 for HTTP/1 requests, resets oversized HTTP/2 streams, and rejects oversized memcache and couchbase responses from their declared lengths. Progressive HTTP reading remains supported because it uses bounded buffering.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Oct 21, 2026
Last modified: Oct 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-619074.3An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert per CVE-2026-619086.5An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user CVE-2026-619094.3An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some sh CVE-2026-61916.3A vulnerability was determined in itsourcecode Construction Management System 1.0. This affects an unknown function of the file /equipments.CVE-2026-619105.0An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticate CVE-2026-619114.3An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve CVE-2026-619157.1An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyr CVE-2026-61916Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is CVE-2026-619187.5Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.CVE-2026-61923.3A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opj_pi_initialise_encode in the library src/lib/CVE-2026-619206.6Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an authorized attacker to CVE-2026-619216.5Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.